Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
145 results · page 2 of 3
May 29, 2024A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected CVE-2024-35284 · Email & office · Mitel · reported by MITREMedium 5.4
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation.
- Product
- Micontact Center Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2024A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-siCVE-2024-35283 · Email & office · Mitel · reported by MITREMedium 6.1
A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insufficient input validation.
- Product
- Micontact Center Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attackers to escalate pCVE-2024-33225 · Other software · dell · reported by MITREHigh 7.8
An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- Product
- realtek_high_definition_audio_driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileges and execute arbitCVE-2024-33224 · Network & remote access · realtek · reported by MITREHigh 8.4
An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- Product
- io_driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, anCVE-2023-46870 · Other software · nordicsemi · reported by MITREHigh 7.3
extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, and 4.1.1 have set incorrect file permission, which allows attackers to do code execution via modified bash and python scripts.
- Product
- nrf_sniffer_for_bluetooth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2024A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected CVE-2024-28070 · Email & office · Mitel · reported by MITREMedium 6.8
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive information and gain unauthorized access.
- Product
- Micontact Center Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2024A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an informatiCVE-2024-28069 · Email & office · mitel · reported by MITREHigh 7.5
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to access sensitive information and potentially conduct unauthorized actions within the vulnerable component.
- Product
- micontact_center_business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing foCVE-2023-21416 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 7.1
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account however the impact is equal. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023 General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application.CVE-2023-0898 · Other software · General Electric · reported by ics-cert@hq.dhs.govMedium 5.3
General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application.
- Product
- MiCOM S1 Agile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafCVE-2023-25597 · Email & office · Mitel · reported by MITREMedium 5.9
A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due CVE-2023-22854 · Email & office · Mitel · reported by MITREHigh 7.5
The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.
- Product
- Micontact Center Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via CVE-2022-40480 · Other software · Microchip · reported by MITREMedium 6.5
Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via a crafted ConReq packet.
- Product
- Dt100112 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblediff.github.ioblediff.github.io
Nov 21, 2022The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorizatCVE-2022-41326 · Email & office · Mitel · reported by MITRECritical 9.8
The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrCVE-2022-35740 · Other software · Dotcms · reported by MITREMedium 6.1
dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS.
- Product
- Dotcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files.CVE-2022-36452 · Email & office · Mitel · reported by MITRECritical 9.8
A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to iCVE-2022-36454 · Email & office · Mitel · reported by MITREMedium 6.5
A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to impersonate another user's name.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters duCVE-2022-36453 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to control another extension number.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side RequeCVE-2022-36451 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage connections and permissions available to the host server.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which acCVE-2022-34150 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govHigh 7.1
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” wCVE-2022-33944 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govMedium 6.5
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a userCVE-2022-2199 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govHigh 7.5
The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.CVE-2022-2141 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govCritical 9.8
SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password.CVE-2022-2107 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govCritical 9.8
The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
- Product
- MiCollab, MiVoice Business Express
- On CISA’s list since
- Mar 25, 2022 (federal fix deadline Apr 15, 2022)
- What to do
- Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogarstechnica.comblog.cloudflare.com
Aug 13, 2021The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attackerCVE-2021-3352 · Email & office · Mitel · reported by MITRECritical 9.1
The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access (view and modify) user data without authorization due to improper handling of tokens.
- Product
- Micontact Center Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application dataCVE-2021-32072 · Email & office · Mitel · reported by MITREMedium 6.5
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control.CVE-2021-32071 · Email & office · Mitel · reported by MITRECritical 9.8
The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response.CVE-2021-32070 · Email & office · Mitel · reported by MITREMedium 5.4
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation.CVE-2021-32069 · Email & office · Mitel · reported by MITREMedium 4.8
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple seCVE-2021-32068 · Email & office · Mitel · reported by MITRELow 3.7
The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to CVE-2021-32067 · Email & office · Mitel · reported by MITREMedium 6.5
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary direcCVE-2021-27402 · Email & office · Mitel · reported by MITREMedium 6.5
The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due CVE-2021-27401 · Email & office · Mitel · reported by MITREMedium 6.1
The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS).
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels.CVE-2020-27211 · Other software · Nordicsemi · reported by MITREMedium 5.7
Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels. The flash read-out protection (APPROTECT) can be bypassed by injecting a fault during the boot phase.
- Product
- Nrf52840 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeprint.iacr.orginfocenter.nordicsemi.com
May 21, 2021The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 20CVE-2021-29415 · Other software · Nordicsemi · reported by MITREMedium 5.5
The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 2021-03-29 has a non-constant time ECDSA implemenation. This allows an adversary to recover the private ECC key used during an ECDSA operation.
- Product
- Nrf52840 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeprint.iacr.orgaisec.fraunhofer.de
Mar 29, 2021The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficiCVE-2021-26714 · Email & office · Mitel · reported by MITRECritical 9.8
The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal.
- Product
- Micontact Center Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2021A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user dataCVE-2020-35547 · Email & office · Mitel · reported by MITRECritical 9.1
A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolCVE-2021-3181 · Other software · Mutt · reported by MITREMedium 6.5
rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Dec 18, 2020The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to iCVE-2020-27340 · Email & office · Mitel · reported by MITREMedium 6.1
The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control.CVE-2020-25612 · Email & office · Mitel · reported by MITREMedium 4.9
The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control. Successful exploit could potentially allow an attacker to gain access to sensitive information.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input valCVE-2020-25611 · Email & office · Mitel · reported by MITREMedium 6.1
The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input validation, aka XSS. Successful exploitation could allow an attacker to view user conference information.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference codeCVE-2020-25610 · Email & office · Mitel · reported by MITREMedium 5.3
The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference codes.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validatioCVE-2020-25609 · Email & office · Mitel · reported by MITREMedium 5.4
The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection.CVE-2020-25608 · Email & office · Mitel · reported by MITREHigh 7.2
The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, akCVE-2020-25606 · Email & office · Mitel · reported by MITREMedium 6.1
The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, aka XSS.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitizatCVE-2020-24693 · Email & office · Mitel · reported by MITRELow 3.3
The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitization.
- Product
- Micontact Center Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2020There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52.CVE-2020-28175 · Other software · Almico · reported by MITREHigh 7.8
There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52. Attackers can use constructed programs to increase user privileges
- Product
- Speedfan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2020A wmiconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): PriorCVE-2020-7177 · Other software · HP · reported by security-alert@hpe.comHigh 8.8
A wmiconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
- Product
- Intelligent Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Sep 25, 2020The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aCVE-2020-24692 · Email & office · Mitel · reported by MITREHigh 7.1
The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session.
- Product
- Micontact Center Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2020An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could aCVE-2020-11797 · Email & office · Mitel · reported by MITREHigh 7.5
An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit could allow an attacker to access sensitive shared files.
- Product
- Micollab Audio, Web & Video Conferencing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.